An approved requestor must sign and enter into a Data Use Agreement or contract with CIVHC and agree to the following:
- Restrictions on data disclosure and prohibitions on re-release of the data.
- Prior approval from CIVHC subject to DRRC guidelines is required to publicly release any reports based on the data. CIVHC will carefully review all materials intended for publication or dissemination to determine whether the privacy rights of any individual would be violated by the release of the information.
- Violation of the terms of the Data Use Agreement constitutes a breach of contract and may:
- Require the immediate surrender and return of all CO APCD data.
- Result in denial of future access to CO APCD data.
- Lead to civil action by CIVHC for breach of contract.
- Result in a complaint filed with the U. S. Department of Health & Human Services, Office for Civil Rights, as well as civil and criminal action and penalties.
- State Attorneys General are also empowered under the HITECH Act to take civil action regarding certain HIPAA violations.